CVE-2012-6137: rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classi...

Security readout for executives and security teams

This flaw affected Red Hat's migration tool for moving from RHN Classic to certificate-based subscriptions. During migration, the tool failed to verify the server certificate, so an attacker on the network path could impersonate the server and capture sensitive information, including credentials. Exposure is most likely on legacy Red Hat systems that used rhn-migrate-classic-to-rhsm for RHN Classic migration. The source bundle does not identify exact affected package versions or CPEs, so asset validation must use Red Hat advisory data. Prioritize if legacy Red Hat subscription migration tooling remains in use or credentials from past migrations were reused. The main concern is credential theft, not broad unauthenticated system takeover. Mitigation focus: Review Red Hat RHSA-2013:0788 and Bugzilla guidance for affected package details.; Update Red Hat subscription-manager packages according to vendor guidance.; Avoid running legacy migration tooling across untrusted networks until remediated..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.